From nobody Sun Feb 8 22:59:32 2026 Received: from smtp.gnome.org (smtp.gnome.org [44.216.4.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E314280325; Tue, 28 Oct 2025 06:31:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=44.216.4.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761633094; cv=none; b=hT5roZCx8Lf17DjURjiEoPqzXMWU8KRey3WuYmGAX1oMksEIZLxoDPUJecnHK/kLn0hSMbTvJ24GbIfBQwka8veb1WudHgDbwp9s98VSLO+zWAJckH3Cb7HDRVbPPLPrI53wI1JVyu8zBbsLT9ucbB9NELmXYGnK01LWtpeIMEU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761633094; c=relaxed/simple; bh=zdg2WR5ElEOcFpZPdBEjMwQHKx2E+JT6vJwGPJcp43k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YTiRZssUo7VXwF9H4Qfx6y0017D9Oh5b1bAHsam250qp/6/eSvLwaHggZToFyCsp4JLiOkLcvRHp+w1tPqJHTDxBrYtUwORRfDEwGn1njdDpSV2eDBeZ4LHlYBsiKuDIZeWuR2+VPQTDdUrDjZK3vrDukC/mlpYG0SiRS6XO75c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=gnome.org; spf=pass smtp.mailfrom=gnome.org; dkim=pass (1024-bit key) header.d=gnome.org header.i=@gnome.org header.b=PhVqOnrZ; arc=none smtp.client-ip=44.216.4.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=gnome.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gnome.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=gnome.org header.i=@gnome.org header.b="PhVqOnrZ" Received: from localhost.localdomain (unknown [61.185.218.172]) by smtp.gnome.org (Postfix) with ESMTPSA id 62CDD1098412F; Tue, 28 Oct 2025 06:31:23 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp.gnome.org 62CDD1098412F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gnome.org; s=default; t=1761633086; bh=yh01/ijVBeH4YcUsL82QrdCb3TZ1vLYINr3BHOaQgsQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PhVqOnrZHWSlcqtqwReeE0KmCPGBsMe/JlrcVgQb0UHN1ZCfBYeQBP4AZCkOnxVIr rupvqUOqV7d8cc0/+TX0fnGrpkx4vULFTkFgJVuz7N6PieWxiiaCH1gZ4vSSAKHzl+ gywkY8VoXsDWiP3WB7sPk2YCedHQemiq7IlOmhXg= From: Qiu Wenbo To: Daniel Scally , Hans de Goede Cc: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Andy Shevchenko , Sakari Ailus , platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2] platform/x86: int3472: Fix double free of GPIO device during unregister Date: Tue, 28 Oct 2025 14:30:09 +0800 Message-ID: <20251028063009.289414-1-qiuwenbo@gnome.org> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20251024050537.92440-1-qiuwenbo@gnome.org> References: <20251024050537.92440-1-qiuwenbo@gnome.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Qiu Wenbo regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration. Cc: stable@vger.kernel.org Fixes: 1e5d088a52c2 ("platform/x86: int3472: Stop using devm_gpiod_get()") Signed-off-by: Qiu Wenbo Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Reviewed-by: Hans de Goede --- Changes since V1: - Add Reviewed-by: from Andy Shevchenko and Sakari Ailus - Add Cc to stable@ - Remove the blank line after Fixes: drivers/platform/x86/intel/int3472/clk_and_regulator.c | 5 +---- include/linux/platform_data/x86/int3472.h | 1 - 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/platform/x86/intel/int3472/clk_and_regulator.c b/drive= rs/platform/x86/intel/int3472/clk_and_regulator.c index 476ec24d37020..9e052b164a1ab 100644 --- a/drivers/platform/x86/intel/int3472/clk_and_regulator.c +++ b/drivers/platform/x86/intel/int3472/clk_and_regulator.c @@ -245,15 +245,12 @@ int skl_int3472_register_regulator(struct int3472_dis= crete_device *int3472, if (IS_ERR(regulator->rdev)) return PTR_ERR(regulator->rdev); =20 - int3472->regulators[int3472->n_regulator_gpios].ena_gpio =3D gpio; int3472->n_regulator_gpios++; return 0; } =20 void skl_int3472_unregister_regulator(struct int3472_discrete_device *int3= 472) { - for (int i =3D 0; i < int3472->n_regulator_gpios; i++) { + for (int i =3D 0; i < int3472->n_regulator_gpios; i++) regulator_unregister(int3472->regulators[i].rdev); - gpiod_put(int3472->regulators[i].ena_gpio); - } } diff --git a/include/linux/platform_data/x86/int3472.h b/include/linux/plat= form_data/x86/int3472.h index 1571e9157fa50..b1b837583d544 100644 --- a/include/linux/platform_data/x86/int3472.h +++ b/include/linux/platform_data/x86/int3472.h @@ -100,7 +100,6 @@ struct int3472_gpio_regulator { struct regulator_consumer_supply supply_map[GPIO_REGULATOR_SUPPLY_MAP_COU= NT * 2]; char supply_name_upper[GPIO_SUPPLY_NAME_LENGTH]; char regulator_name[GPIO_REGULATOR_NAME_LENGTH]; - struct gpio_desc *ena_gpio; struct regulator_dev *rdev; struct regulator_desc rdesc; }; --=20 2.51.2